linux/meta-security.git/recipes-security/sssd, branch kirkstone

sssd: Fix for CVE-2025-11561

2026-01-15T16:46:30+00:00

Upstream-Status: Backport [https://github.com/SSSD/sssd/commit/a0336f4cd69c25b3d501a3d361d3d286c00da4d2] Signed-off-by: Vijay Anusuri Signed-off-by: Scott Murray

sssd: Fix CVE-2023-3758

2024-05-05T12:37:19+00:00

A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately. References: https://nvd.nist.gov/vuln/detail/CVE-2023-3758 Signed-off-by: Soumya Sambu Signed-off-by: Armin Kuster

sssd: ignore CVE-2018-16838

2022-07-21T23:46:46+00:00

CVE-2018-16838 is patched in our version of sssd but it doesn't have a vulnerable version range in the NVD database, that's why it needs to be ignored. Signed-off-by: Davide Gardenal

meta-security : Use SPDX style licensing format

2022-04-02T18:21:42+00:00

WARNING: selinux-sandbox-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \ WARNING: selinux-gui-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \ WARNING: semodule-utils-3.3-r0.1 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \ WARNING: selinux-dbus-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \ WARNING: libwhisker2-perl-2.5-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPL-1.0+ [obsolete-license] \ WARNING: lib-perl-0.63-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPL-1.0+ [obsolete-license] \ WARNING: libhtp-0.5.39-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2 [obsolete-license] \ ... Signed-off-by: Ashish Sharma Signed-off-by: Armin Kuster

sssd: Create /var/log/sssd in runtime

2021-11-07T19:26:49+00:00

/var/log is normally a link to /var/volatile/log and /var/volatile is a tmpfs mount. So anything created in /var/log will not be available when the tmpfs is mounted. [Thanks to Peter Kjellerstedt for example] Signed-off-by: Armin Kuster

sssd: re-package to fix QA issues

2021-10-19T04:50:22+00:00

It packages all file in ${libdir} to package sssd, including the .so symlink files. Then it causes QA issues: | ERROR: QA Issue: sssd rdepends on dbus-dev [dev-deps] | ERROR: QA Issue: sssd rdepends on ding-libs-dev [dev-deps] So re-package sssd then the .so symlink files and .pc files are packaged to sssd-dev which should be. File ${libdir}/libsss_sudo.so is not a symlink file but packaged to sssd-dev too. Then causes another QA issue: | ERROR: sssd-2.5.2-r0 do_package_qa: QA Issue: -dev package sssd-dev contains non-symlink .so '/usr/lib/libsss_sudo.so' [dev-elf] So create a new sub-package libsss-sudo to package file libsss_sudo.so and make sssd rdepends on it. Signed-off-by: Kai Kang Signed-off-by: Armin Kuster

sssd: 2.5.1 -> 2.5.2

2021-09-10T14:23:00+00:00

SSSD 2.5.2 Highlights * General information - originalADgidNumber attribute in the SSSD cache is now indexed * New features - Debug messages in data provider include a unique request ID that can be used to track the request from its start to its end (requires libtevent >= 0.11.0) * Important fixes - Update large files in the files provider in batches to avoid timeouts * Configuration changes - Add new config option fallback_to_nss Full release notes: * https://sssd.io/release-notes/sssd-2.5.2.html And backport patch to fix CVE-2021-3621. CVE: CVE-2021-3621 Signed-off-by: Kai Kang Signed-off-by: Armin Kuster

meta-security: Convert to new override syntax

2021-08-01T15:47:08+00:00

Signed-off-by: Armin Kuster

sssd: update to 2.5.1

2021-07-04T17:59:17+00:00

See full change log: https://sssd.io/release-notes/sssd-2.5.1.html Including a musl build work around Signed-off-by: Armin Kuster

sssd: add fix-ldblibdir.patch back

2021-06-20T22:49:26+00:00

The patch fix-ldblibdir.patch has been dropped when update sssd to 2.5.0. But it fails to start sssd without this patch. So add it back. Signed-off-by: Kai Kang Signed-off-by: Armin Kuster